prefect-cve-2026-5366

PoC: CVE-2026-5366 - حقن وسيطات Git في Prefect GitRepository الثغرة: حقن وسيطات Git يؤدي إلى تنفيذ تعليمات برمجية عن بعد RCE عبر commitsha بالإضافة إلى حقن وسيطات عبر directories الإصدار: معرض للخطر في 3.6.23، تم إصلاحه في 3.6.25+ الملف: src/prefect/runner/storage.py Huntr:...

CVE-2026-5366

Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the "GitRepository" storage class. The "commitsha" parameter, which is passed to git commands, lacks validation and does not include a "--" separator to distinguish user input from g...

CVE-2026-5366: Improper Control of Generation of Code

Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commitsha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git...